{"id":"CVE-2026-89791","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix use-after-free when perf mmap() revival races with the last munmap()\n\nperf_mmap_close() drops rb->mmap_count *without* holding\nevent->mmap_mutex (the refcount…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix use-after-free when perf mmap() revival races with the last munmap()\n\nperf_mmap_close() drops rb->mmap_count *without* holding\nevent->mmap_mutex (the refcount…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 59741451b49ce9964a9758c19d6f7df2a1255c75 < 929cb3b9dc818dd9fa89d510d4ff2b255e42badd","Linux >= 59741451b49ce9964a9758c19d6f7df2a1255c75 < 0c739f54f1c77f3a4643160cd2e031b6c2f2aab6","Linux >= 59741451b49ce9964a9758c19d6f7df2a1255c75 < 58a8108bc73de0740d5b88150465d6690ea5f85f","Linux 6.18"],"published":"2026-09-16","updated":"2026-09-16","sourceUpdated":"2026-09-16T15:18:09.253","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-89791","references":[{"url":"https://git.kernel.org/stable/c/0c739f54f1c77f3a4643160cd2e031b6c2f2aab6","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/58a8108bc73de0740d5b88150465d6690ea5f85f","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/929cb3b9dc818dd9fa89d510d4ff2b255e42badd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89791.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89791"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535070"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89791"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89791"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89791.mbox"},{"url":"https://access.redhat.com/errata/RHSA-2026:88477"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ingestedAt":"2026-09-16T08:52:29.592Z","epss":0.00184,"epssPercentile":0.07926,"patched":["10base_smtv","enterprise_linux_appstream_v_10","enterprise_linux_baseos_v_10","enterprise_linux_codeready_linux_builder_v_10","enterprise_linux_hidden_v_10","enterprise_linux_real_time_for_nfv_v_10","enterprise_linux_real_time_v_10"],"cwe":["CWE-825"],"scores":{"nvd":7.8,"vendor":7},"slug":"CVE-2026-89791","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nperf: Fix use-after-free when perf mmap() revival races with the last munmap()\n\nperf_mmap_close() drops rb->mmap_count *without* holding\nevent->mmap_mutex (the refcount_dec_and_test() right before the\nrefcount_dec_and_mutex_lock() of event->mmap_count). A concurrent\nperf_mmap_rb() can slot its entire \"revival\" path into that window\n(perf_mmap holds event->mmap_mutex for its whole duration, including\nrb_alloc):\n\n  munmap side (perf_mmap_close)          mmap side (perf_mmap_rb)\n  -----------------------------------    --------------------------------\n  rb->mmap_count 1 -> 0   (no lock)      (holds event->mmap_mutex)\n                                         inc_not_zero(rb->mmap_count) fails\n                                         ring_buffer_attach(event, NULL)\n                                         rb_alloc() + attach new rb\n                                         refcount_set(&event->mmap_count, 1)\n  lock; event->mmap_count 1 -> 0\n  ring_buffer_attach(event, NULL)\n  ring_buffer_put() -> frees the *new* rb\n\nThe revival's refcount_set(&event->mmap_count, 1) is an invisible\n1 -> 1 write: the close frees the just-revived buffer although the\nother process still has it mapped -- a page-level use-after-free\nallowing local privilege escalation to root by any unprivileged user\n(default kernel.perf_event_paranoid=2).\n\nSwap the order of the two counter updates: event->mmap_count is\ndropped first via refcount_dec_and_mutex_lock(), so its 1 -> 0\ntransition and the ring_buffer_attach() stay serialized with\nperf_mmap(). rb->mmap_count == 0 then implies every event using the\nbuffer is detached already, so the result of the rb->mmap_count drop\ncan gate the remaining teardown directly and detach_rest is no longer\nneeded.\n\nAn earlier fix for this race from Kyle Zeng and David Lee takes\nevent->mmap_mutex around both counter updates [0]; here the not-last\nclose stays lockless.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:88477** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:88477)\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 6 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89791.json)","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":205259,"id":"CVE-2026-89791","ts":1789570705969,"field":"cvss","old":null,"new":"7.8"},{"seq":205258,"id":"CVE-2026-89791","ts":1789570705969,"field":"severity","old":"none","new":"high"}]}